﻿using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Xml;

namespace EventViewToExceptionless
{
    class ConvertHelper
    {
        public static LogAnalysisDto GetLogAnalysisDto(string data)
        {
            LogAnalysisDto logAnalysisDto = new LogAnalysisDto();
            XmlDocument xmldoc = new XmlDocument();
            xmldoc.LoadXml(data);

            //需要添加命名空间，否则找不到节点
            XmlNamespaceManager nsMgr = new XmlNamespaceManager(xmldoc.NameTable);
            nsMgr.AddNamespace("ns", "http://schemas.microsoft.com/win/2004/08/events/event");
            //ns是自定义名称,取值格式是 自定义名称:节点名称

            var node = xmldoc.SelectSingleNode("ns:Event", nsMgr);

            XmlElement xe = (XmlElement)node;

            XmlElement systemData = (XmlElement)xe.SelectSingleNode("ns:System", nsMgr);

            //eventID=1309,1310是web错误，1000是系统错误，这里不是很确定，所以用provider来确定
            int eventID = int.Parse(systemData.SelectSingleNode("ns:EventID", nsMgr).InnerText);

            int level = int.Parse(systemData.SelectSingleNode("ns:Level", nsMgr).InnerText);

            string provider = ((XmlElement)systemData.SelectSingleNode("ns:Provider", nsMgr)).GetAttribute("Name").ToString();

            //.net日志且级别大于等于警告
            if (level <= 3)
            {
                //筛选web错误日志
                if (provider.ToLower().Contains("asp.net"))
                {

                    logAnalysisDto.EventID = eventID;
                    logAnalysisDto.ServerName = systemData.SelectSingleNode("ns:Computer", nsMgr).InnerText;

                    //utc时间，需要转换
                    string utcdatetime = ((XmlElement)systemData.SelectSingleNode("ns:TimeCreated", nsMgr)).GetAttribute("SystemTime").ToString();
                    logAnalysisDto.TimeCreated = Convert.ToDateTime(utcdatetime);

                    XmlNodeList datalist = xe.SelectNodes("ns:EventData/ns:Data", nsMgr);
                    logAnalysisDto.ErrorType = datalist[17].InnerText;//小标索引是根据分析实际文档找出的规律。可能不适用其他情况。所以下标视情况而定
                    logAnalysisDto.ErrorMessage = datalist[18].InnerText;
                    logAnalysisDto.Url = datalist[19].InnerText;

                    logAnalysisDto.Website = (new Uri(logAnalysisDto.Url)).Host;

                    logAnalysisDto.UserIp = datalist[21].InnerText;
                    logAnalysisDto.UserId = datalist[22].InnerText;
                }
                //筛选系统错误日志而且是iis触发的
                else if (provider.ToLower().Contains("application error"))
                {
                    XmlNodeList datalist = xe.SelectNodes("ns:EventData/ns:Data", nsMgr);
                    string data0 = datalist[0].InnerText;
                    if (data0.ToLower() == "w3wp.exe")
                    {
                        logAnalysisDto.EventID = eventID;
                        logAnalysisDto.ServerName = systemData.SelectSingleNode("ns:Computer", nsMgr).InnerText;
                        //utc时间，需要转换
                        string utcdatetime = ((XmlElement)systemData.SelectSingleNode("ns:TimeCreated", nsMgr)).GetAttribute("SystemTime").ToString();
                        logAnalysisDto.TimeCreated = Convert.ToDateTime(utcdatetime);
                        logAnalysisDto.ErrorType = datalist[6].InnerText;
                        logAnalysisDto.ErrorMessage = datalist[10].InnerText;
                    }
                }
            }
            return logAnalysisDto;
        }
    }
}
